alienbot | 50ed006fb1be9516185367ada34c9b5c1da69223c62f533be1107f8b8bd2f76f

Resubmissions

26-04-2024 09:26

240426-lefhmsde4x 10

11-01-2024 20:33

240111-zbwx4sghg8 10

Analysis

max time kernel
4198287s
max time network
140s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
11-01-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

548346ff3b5bb8a9f0da40fd4ebdcb2a.apk
Size

3.2MB
MD5

548346ff3b5bb8a9f0da40fd4ebdcb2a
SHA1

e4cd2bfe551d9f9fdbfd3f96be7ecb7f120257f3
SHA256

50ed006fb1be9516185367ada34c9b5c1da69223c62f533be1107f8b8bd2f76f
SHA512

43106eaad33af80f77335c4141a2a83f782b2fe576c1ca3e4abe14314d5d3fe9f574a8ebb8a74ef664b0812affeaf128fbe5ae197d64dd83d5be5b2388893430
SSDEEP

98304:NvIuD/ow/xt+GCUtvl+PceDIIAJXaIlgIi1gQ2:1zo8x0G7Eb/A6aQ2

Score

10^/10

alienbot banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

alienbot

http://5s2kbkv6434w.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	stove.senator.friend
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	stove.senator.friend
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	stove.senator.friend

Removes its main activity from the application launcher 2 IoCs

stealth trojan

pid	Process
4206	stove.senator.friend
4206	stove.senator.friend

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json	4258	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/stove.senator.friend/app_DynamicOptDex/oat/x86/pEGpjIW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json	4206	stove.senator.friend

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	stove.senator.friend

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	stove.senator.friend

stove.senator.friend
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4206
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/stove.senator.friend/app_DynamicOptDex/oat/x86/pEGpjIW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4258

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/stove.senator.friend/app_DynamicOptDex/oat/pEGpjIW.json.cur.prof

Filesize
1KB

MD5
bef1a762f9374fde9c84f586b8de90df

SHA1
d437f377cfcf230981e50476a14cb1f6386ee98f

SHA256
30873f80b6945e09782589f814d8603ae09bafd0bffd250c571b56df515b48f2

SHA512
b1533d8e2fbd1e93b1d580ef4ffc116b42f90a97843dc6baf53c9727889b2200373fdb2344f1b645a305c663a73f2ce6fedc194d9f4d23336cf6a5e3119f5204

Download Submit
/data/data/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json

Filesize
615KB

MD5
1f5989bfdc4c8d5d3d40ef686beab202

SHA1
013f38da5937ddf5e4070b8d5924b39b0c91242e

SHA256
a5db95c044a1af09e8b19f338c1fd91ee7bfc10859c2a3cf6d20a39bac602bae

SHA512
67b6265be1a5b28a69149c89ba4676c43f374972a4e2714fe43339fc2a3007c021f053494289186e836377dddfdf689cc307102ed7014b03cd612039ecb187fa

Download Submit
/data/data/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json

Filesize
615KB

MD5
542bbb7b299084c15f47819dec81df1c

SHA1
a1d8bb63715a460d4af34cc9bf91d7b3b56d8bd1

SHA256
07705a62ac4ba8345923b1681488e6d5b239b7212bff8096610003cdbcb5154a

SHA512
15f83d229d89204798daea813f41396a7544c7152a4781595c40c382bd84c536e7ab8734d97a2a4e51ed8b531b8cf11a252f9a364b6024cdb8dfe4e4e97729bc

Download Submit
/data/user/0/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json

Filesize
767KB

MD5
3667df1448612d38339035b8bf9a4ea3

SHA1
1ec6d8cb90c814e4a7695b035cc736ed12b1d323

SHA256
08597cba49aeaac6fb98bc884449d18cadd6dedfe809760e2206f97e4825fd4e

SHA512
4a2b517a96011d71831d61d3096a91af3cd9b765fc568db6304ed1bdaf04b7102d66a7eca9a92739f99c947793ccd319d8c5804200925088bab0e4ce30816c6d

Download Submit
/data/user/0/stove.senator.friend/app_DynamicOptDex/pEGpjIW.json

Filesize
767KB

MD5
672d4f79552ab1939bb592ab16431c5a

SHA1
e342f10be5e12456e6fc2990c4af155880b43778

SHA256
db9830014b6a05af7704eb0839db3bb23da2ef245ea80613f3d8ffd8a8ba3f04

SHA512
0658a95660e69647fb67b8f9e79274ab1bff13aa7bf067479d8b33f4815564300dbdb2c87917d814901e60514584badb111befe042591afd0150a3b3c6e5f16d

Download Submit